The vulnerability CVE-2026-28032 in ThemeREX Tuning arises from improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include and potentially execute local files on the server. The affected versions are up to and including 1.3. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to include arbitrary local files on the server running ThemeREX Tuning, potentially leading to sensitive information disclosure, code execution, or denial of service. The high CVSS score (8.1) indicates a serious risk to confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and implementing web application firewall rules to detect and block suspicious include/require requests if possible. Monitor ThemeREX vendor communications for updates and apply patches promptly once available.